Skip to content

Commit d83bd25

Browse files
committed
regcomp_trie: stringify *tmp before accessing string fields
... such as SvCUR(*tmp) and SvUTF8(*tmp). Fixes Coverity ID 582459: Evaluation order violation (EVALUATION_ORDER) > read_write_order: In argument #3 of `Perl_pv_pretty(my_perl, sv, (char const *)Perl_SvPV_helper(my_perl, *tmp, NULL, 2U, SvPVnormal_type_, Perl_sv_2pv_flags, false, 32U), *({...; &((XPV *)({...; p_;}))->xpv_cur;}), colwidth, my_perl->Icolors[0], my_perl->Icolors[1], (((*tmp)->sv_flags & 0x20000000U) ? 256 : 0) | 0x800)`, a call is made to `Perl_SvPV_helper(my_perl, *tmp, NULL, 2U, SvPVnormal_type_, Perl_sv_2pv_flags, false, 32U)`. In argument #2 of this function, the object `(*tmp)->sv_flags` is modified. This object is also used in `(((*tmp)->sv_flags & 0x20000000U) ? 256 : 0) | 0x800`, the argument #8 of the outer function call. The order in which these arguments are evaluated is not specified, and will vary between platforms.
1 parent 96784b0 commit d83bd25

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

regcomp_trie.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -224,9 +224,11 @@ S_dump_trie_interim_table(pTHX_ const struct _reg_trie_data *trie,
224224
for( charid = 0 ; charid < trie->uniquecharcount ; charid++ ) {
225225
SV ** const tmp = av_fetch_simple( revcharmap, charid, 0);
226226
if ( tmp ) {
227+
STRLEN n;
228+
const char *s = SvPV_const(*tmp, n);
227229
Perl_re_printf( aTHX_ "%*s",
228230
colwidth,
229-
pv_pretty(sv, SvPV_nolen_const(*tmp), SvCUR(*tmp), colwidth,
231+
pv_pretty(sv, s, n, colwidth,
230232
PL_colors[0], PL_colors[1],
231233
(SvUTF8(*tmp) ? PERL_PV_ESCAPE_UNI : 0) |
232234
PERL_PV_ESCAPE_FIRSTCHAR

0 commit comments

Comments
 (0)